Plenty of vulnerability data from your intelligence feed, but still deciding by hand which CVEs to review first?
Free plan: 500 CVEs a month, no sales call.
VulnCheck is an exploit and vulnerability intelligence provider: a large index-based API with its own KEV catalogue, threat-adjusted CVSS, generated SSVC decisions and exploit, botnet and ransomware data. DevSecure Intelligence turns a CVE list into one ranked, explained order, with the scoring formula published.
VulnCheck details from VulnCheck's public material, last reviewed 21/10/2026 (sources below).
DevSecure capabilities shown in this comparison reflect the DevSecure Intelligence launch specification. Commercial availability may vary by plan and rollout status.
| Dimension | DevSecure Intelligence | VulnCheck | Why it matters |
|---|---|---|---|
| Core purpose | Prioritisation: send CVE IDs, get a ranked, banded answer with evidence | Exploit and vulnerability intelligence data across hundreds of indices | Decide whether you want signals to build on or a ranked answer to act on. |
| Scoring | One published per-CVE score (RPS) over CVSS, EPSS percentile and KEV, with documented band rules | Threat-adjusted CVSS-BT, EPSS and generated SSVC decisions; we found no single published composite score | One reproducible number is simpler to automate; several signals give analysts more to weigh. |
| Explanation per CVE | The rule that set the band, signal values, source timestamps and what would change the priority | The underlying signals and citations; ranking is left to you or your vulnerability management tool | An explanation attached to the rank is what auditors and reviewers ask for. |
| Exploitation evidence | CISA KEV, EPSS, Exploit-DB and Metasploit evidence in context | VulnCheck KEV (thousands of entries; VulnCheck reports about 80% more exploited CVEs than CISA KEV), a curated PoC catalogue (XDB), initial-access, botnet and ransomware data | VulnCheck's exploitation dataset is broader; we focus on turning evidence into an order. |
| API design | Prioritisation-first: one call ranks a list (POST /api/v1/prioritize) | Data-first: query indices for the attributes you need; Go and Python SDKs and a CLI | Prioritisation-first returns decisions; data-first gives flexibility to build your own. |
| Fix data | Patch evidence in responses (Business and Enterprise) | Vendor advisory feeds and package fixed-version data | Knowing a fix exists next to the rank shortens the path to remediation. |
| Pricing | Published plans, including a free tier | Free Community tier (VulnCheck KEV, NVD++); commercial tiers quote-based | Predictable costs and no procurement cycle for a first evaluation. |
| AI agents | MCP server exposing prioritisation with explanations | Official open-source MCP server | Both can serve agents; the question is whether the agent gets data or a ranked answer. |
Send the CVEs your scanners found to POST /api/v1/prioritize. Each result carries the RPS score, the Final Priority, the rule behind it (RPS threshold, KEV floor or EPSS gate), the inputs with their timestamps, and what would change the priority. The formula is on the methodology page, so any result can be recomputed.
curl -X POST https://api.intelligence.devsecure.io/api/v1/prioritize \
-H "Authorization: Bearer $DEVSECURE_API_KEY" \
-H "Content-Type: application/json" \
-d '{"cve_ids": ["CVE-2021-44228", "CVE-2024-3400"]}'{
"ranked": [
{
"rank_in_request": 1,
"cve_id": "CVE-2021-44228",
"rps_score": 105.0,
"priority_band": "critical_priority",
"recommended_next_step": "review_against_internal_sla"
},
...
]
}RPS = [(0.4 × CVSS/10) + (0.3 × EPSS percentile)] × KEV amplifier × 100
The KEV amplifier is 1.5 for CVEs in CISA KEV, otherwise 1.0. A KEV-listed CVE is never below High, and neither is one with an EPSS percentile of 0.99 or more and CVSS 9 or more. Full detail: methodology. API: prioritise scanner output.
VulnCheck offers far broader exploitation intelligence than we do: its own KEV catalogue, PoC curation, initial-access, botnet, ransomware and honeypot data. Teams with analysts who build their own prioritisation from raw signals get a lot from that breadth. DevSecure Intelligence is for teams who want a published, explainable ranking without building that layer themselves.
It depends on the job. If you use VulnCheck's exploitation datasets to build your own prioritisation, VulnCheck stays valuable. If you want a published, explainable ranking out of the box, DevSecure Intelligence provides that directly.
Yes. Many teams take exploitation context from an intelligence feed and use DevSecure Intelligence for the ranked, explained order of their own CVEs.
RPS combines CVSS, the EPSS percentile and CISA KEV with published weights; KEV-listed CVEs are never below High, nor are CVEs with an EPSS percentile of 0.99 or more and CVSS 9 or more. See the methodology page.
Yes. The Free plan includes 500 CVEs a month with one API key.
Send the CVEs you already have and get a ranked answer with the evidence for every rank. Your organisation applies its own SLA.
VulnCheck is a trademark of its owner, used here only to identify the product compared; no affiliation or endorsement is implied. Figures attributed to VulnCheck are VulnCheck's own claims. Something out of date? Report an inaccuracy or email legal@devsecure.io. Changes since publication: changelog.